fix: change SameSite=Strict to SameSite=Lax for session and CSRF cookies (#46)

Safari's ITP blocks Strict cookies on certain navigations (direct URL entry,
reverse proxy context), resulting in a 401 on login even with valid credentials.
Lax is safe: CSRF attacks are prevented by the double-submit token and the
HTTPS-only secure flag. Firefox and Chrome were unaffected.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "oikos",
-  "version": "0.17.1",
+  "version": "0.17.2",
   "description": "Self-hosted family planner - calendar, tasks, shopping, meal planning, budget and more. Private, open-source, no subscription.",
   "main": "server/index.js",
   "type": "module",